EP1084465B1 - Method for secured access to data in a network - Google Patents

Abstract

A method for secured access to data in a network has the effect that data protection rights are respected, especially personal data present in a network with distributed memories. The method is based on the granting of access rights, with the possibility of revocation, to the data available in the network, and the storage of data within the network only after authorization by the owner of the rights to the data. When certain data are requested, only the references of those data records to which the requesting party also has the access rights can be given. Identification of the data is not possible without access rights. Should certain data be accessed, the access rights may be verified before data access is permitted.

Description

The invention relates to a method for secure access to data in a network, especially in a network with an information center and at least one data space access system, wherein the term data space access system is understood to mean a device, the storage space (Dataroom) provides and access to stored Data allows.

In the near future, for different interest groups public or private sector, for example in health care, for example for health insurances, the Ministry of Health and medical associations, the so-called "practice networks" are developed. Of the The basic idea of these practice networks is that, due to better communication between different medical practices and / or hospitals at present often redundant medical examinations can be reduced. In this sense, it would be z. B. not necessary to create another x-ray image of a patient's lungs, though a new diagnosis z. B. another doctor with the help of a easily accessible recently recorded X-ray of the lungs of this Patients would be possible. It is in the public interest and that of the Insurance companies that reduce health care, therefore especially the latter to build autonomous medical networks With the help of which different doctors of a patient to his Better and cheaper medical care on the already data created by her colleagues can access this patient.

In today already constructed experimental models, the main problem in ensuring secure communication. They are different Solutions of a doctor's connection to medical units known which is mainly limited to a specific group of doctors are, for. As the radiologist, being naturally a limitation to a special type of information / data is given, z. B. X-rays.

There are already some national and international standards that the Define the type of generation and transmission of medical data. z. B. DICOM for X-rays. BDT for a patient's data. GDT for medical data generated by medical devices were, z. B. from an electrocardiograph or other facilities. Hereby, regarding the secured transmission of medical Data no special requirements, as this is due no different known encryption mechanisms today no Problem is more.

A special task in the transmission of medical data is it to guarantee the individual personality rights of the patient. The transmission of medical information practiced today is always illegal if not on a medical Group such as As a hospital or a medical practice is limited. One Practical network with hundreds of different practices and hospitals as closed To label a group would probably be legal To bypass the privacy of patients. In In this case, a patient would have no option to all group members know, and could of his right to choose another group, such as B. another hospital, make little use.

From W098 / 15910 A is a procedure for secure and confidential exchange medical data in a multi-participant system known. In this system, access to data of a subscriber is only as far as possible, as this access is legitimized by a password.

It is an object of the present invention to provide a method for secure To provide access to data on a network with only the owner the rights to the data may freely dispose of them.

This object is achieved by a method with the features of claim 1. Advantageous developments of this Method can be found in the dependent claims 2 to 24.

By the method according to the invention alone the owner of the rights define access rights to certain data. The once stored Data remains in its storage space and is not centralized collected. Access to such stored data is only possible with the authorization of the owner of the rights to these data possible. For medical data means this z. B. that they are in the place of their creation remain and that other doctors only with the permission of the respective Patients can access this data. Such a permit can be general for certain doctors or even for an individual case.

It is also possible to withdraw a permit once given.

Figur 1

einen beispielhaften Aufbau eines Netzwerks, in dem das erfindungsgemäße Verfahren Anwendung finden kann:

Figur 2

die Erzeugung und Abspeicherung von Daten nach dem erfindungsgemäßen Verfahren:

Figur 3

ein Beispiel einer erfolglosen Anfrage nach bestimmten Daten;

Figur 4

den Abruf und die Erteilung von Zugriffsrechten an bestimmten Daten durch den Inhaber der Rechte an diesen Daten;

Figur 5

ein Beispiel einer erfolgreichen Anfrage nach Daten und ihrer Übertragung an die anfragende Stelle.

The invention and advantageous developments are explained in more detail using an example with reference to the drawings. Show it:

FIG. 1

an exemplary structure of a network in which the inventive method may find application:

FIG. 2

the generation and storage of data by the method according to the invention:

FIG. 3

an example of an unsuccessful request for specific data;

FIG. 4

the retrieval and granting of access to certain data by the holder of the rights to such data;

FIG. 5

an example of a successful request for data and its transmission to the requesting body.

In the following, the inventive method using the example of a practice network explained. Here the system serves to supply a group of Doctors with the medical records of their patients.

The system can be accessed by several doctors, each with access on a Dataroom access system. In addition to these data-volume access systems the system has an information center. In the figure 1 is this system for simplicity with only two Dataroom access systems 1, 2, one of which is an identifier DRZS1 and the another has an identifier DRZS2. Such a data room access system 1, 2 may be constructed at the workplace of one or more doctors, eg. B. is shown in Figure 1, that the data space access system 2 in a practice a doctor B and the data room access system 1 a hospital are constructed in which a doctor A has access to it. Each data room access system 1, 2 can communicate with the information center via a network 4 3 or another data room access system 1, 2 communicate.

Each Dataroom Access System 1, 2 contains a secure datastore, in which the medical data of patients can be stored. This memory is accessed by accessing only one data access the method according to the invention can take place, whereby a data abuse with data stored in this memory is not possible. Further is ensured by the inventive method that only new data can be stored, not those already in another Dataroom access system 1, 2 were stored. Next can both the doctor and the patient independently the data room access system 1. 2 with the information center 3 or one other data space access system connected to the network 4 1, 2 communicate, with only a doctor can save data.

In the information center 3, references to the data of the patients and the associated identification information of patients and physicians stored centrally.

1. Der Sender versieht die von ihm gesendete Information mit einer digitalen Signatur, indem er seinen geheimen Signaturschlüssel verwendet. Hierdurch kann der Sender nicht nachgeahmt werden, wobei der Empfänger eine verwendete digitale Signatur mit Hilfe des öffentlichen Signaturschlüssels bestätigen kann. Wenn z. B. ein Datenraum-Zugriffssystem die Information über einen Patienten an das Informationscenter versendet, muß diese Information bei der Erzeugung von Daten ebenfalls mit dem geheimen Signaturschlüssel dieses Patienten versehen sein. Hierdurch wird gesichert, daß die Information wirklich zu dem benannten Patienten gehört, und daß dieser der Übertragung dieser Information zustimmt.

2. Der Sender verschlüsselt alle übertragenen Daten mittels eines öffentlichen Verschlüsselungsschlüssels des Empfängers, an den die Daten übertragen werden. Hierdurch können diese übertragenen Daten nur unter Verwendung des geheimen Verschlüsselungsschlüssels des Empfängers entschlüsselt werden.

3. Immer, wenn ein Teilnehmer auf das System zugreift, muß er autorisiert sein und seine Identität bestätigt haben. Ein spezieller Datenträger, wie z. B. eine Chipkarte, kann zur Überprüfung der Identität des Teilnehmers dienen. Natürlich können auch andere Verfahren zur Personenidentifizierung eingesetzt werden, wie z. B. die Spracherkennung, die Bilderkennung, die Erkennung von Fingerabdrücken etc.. von denen jedes einzeln oder in Kombination eingesetzt werden kann.

The security of the individual data transmissions within this system is ensured by an encryption of the data transmissions between all participants. In this case, each information transmitted within the system is provided with a digital signature. Each access requires authorization and all data is transmitted and stored in encrypted form. Each participant, z. As a doctor or a patient, and the information center and each Dataroom access system have two pairs of public and private keys for data encoding. One pair of these keys, called the encryption keys, is used for secure data transmission, and the other, the signature keys, provides the transmitted information, thereby confirming the sender with a digital signature. The secret keys are known only to the respective subscriber, information center or data room access system, whereas the public keys are accessible to all subscribers, ie each subscriber present in the system has the possibility to receive a public key of each other subscriber. Whenever a subscriber sends information over the network, the following procedure is performed:

1. The sender provides the information he has sent with a digital signature by using his secret signature key. As a result, the transmitter can not be imitated, the receiver can confirm a used digital signature using the public signature key. If z. For example, if a data room access system sends the information about a patient to the information center, that information must also be provided with the secret signature key of that patient when generating data. This ensures that the information really belongs to the named patient and that he agrees to the transmission of this information.

2. The sender encrypts all transmitted data using a public encryption key of the recipient to whom the data is transmitted. As a result, these transmitted data can only be decrypted using the secret encryption key of the recipient.

3. Whenever a participant accesses the system, he must be authorized and have confirmed his identity. A special disk, such as. As a smart card, can serve to verify the identity of the subscriber. Of course, other methods for personal identification can be used, such. As the speech recognition, the image recognition, the detection of fingerprints etc .. each of which can be used individually or in combination.

As a secure storage for a subscriber's secret keys and others Personal information can also be a special disk, such as z. B. a smart card can be used.

The public keys of the participants, the information center 3 and the individual data space access systems 1, 2 can z. B. centrally in the information center 3 stored.

FIG. 2 shows the generation of data of a patient and the process how this data is made available in the system.

For example, on a day X, the patient N visits the doctor A and leaves a new one medical data unit, e.g. B. create an X-ray image. If it is the patient N wishes, this data unit can through the practice network other doctors to provide. In this case, the to be stored Data of the X-ray image in a first step S1 in an electronic Form together with an electronic form which shows the type the data contains, in the Dataroom access system 1 with the identifier DRZS1 of the physician A stored. The type of data here is the indication that it is an X-ray image of the patient N, the doctor A on day X has taken. It is also possible that the type of data only one of these details, or more details be added, such as the identifier DRZS1 of the data storing data Dataroom access system 1. The data of the x-ray image are combined with the electronic form in the secure data store the data space access system 1 stored. The saving of data is only if the owner of the rights to these data is authorized, this can z. B. serve the smart card of the patient.

In a second step S2, the information center 3 is accessed by the data space access system 1 notifies that it has new data, namely an x-ray of the patient N. Such a notification can either immediately after saving the new data or to a specific one Time happen, z. B. regularly at a specific time. Of course, it is also possible that the information center 3 to certain Timing requests to each Dataroom access system 1, 2 sends if new data has been saved.

In a third step S3, the information center 3 registers the presence X-ray image of patient N from day X with availability in the Dataroom access system 1 and assigns this data to one simply existing identification, for. Eg NXAX. after which this identification with an alerting confirmation from the information center 3 to the data room access system 1 is transmitted. In the Dataroom Access System 1 becomes the so-assigned identifier for managing the associated data used by adding it to the data. About a corresponding Configuration can be guaranteed that data is not are multiple times in the system. At the latest with the registration of Data through the information center 3 takes place here a review of the authorization the data storage by the patient. In case of non-authorization No participant will be granted access to this data.

In the figure 2, as well as in the following figures, the hollow means Arrow transmission of data in the system, that is, the storage new data in a Dataroom access system 1, 2, and the normal Arrows each communication via the network 4, such. B. a request or notifications. It can therefore be recognized on the basis of FIG. 2 that in the system described the medical data is not in the Information Center 3, but after their storage always remain in the Dataroom Access System 1. The information center 3 keeps only the references to this data and never the data itself. Next In the figures, a data transmission via the network 4 means next to normal arrows displayed rectangles in which the respective transmitted data.

FIG. 3 shows the attempt of data access via the practice network.

On a day Y, the patient N visits a doctor B who has a data room access system 2 with the identifier DRZS2 owns. This doctor B requires z. B. a current x-ray image of the patient N. Therefore he sends in one Step S4 from its Dataroom Access System 2 request X-ray images of the patient N to the information center 3. The information center 3 provides a list of references to all x-ray images of the Patients N currently present in the whole system, d. H. in all connected data space access systems 1, 2 are stored and registered by the Information Center 3. Then check that Information Center 3 the access rights to the listed in this list Data regarding the doctor B, from which the inquiry about X-ray images of the patient N, and transmits only the references in a step S5 X-ray images of the patient N, to whom the doctor B the access rights from the client N, who in this case is the owner of the rights to his Data is received. Since in this case z. From the patient N no access rights have been defined for his X-ray images, this list is empty. Therefore, the information center 3 sends a message "No data found" to the Dataroom access system 2. This gives Send this message to the doctor B.

Thus, without access rights of the patient, who owns the rights At the stored data, no doctor is the presence of the data recognize in the system. An opening of this for certain dates, for which were defined in the individual access rights, secure system is only possible if the patient N z. B. general access rights to its entire Data or specific data given in advance to certain doctors Has. In this case too, however, the patient himself has determined who is his Data, so his privacy rights have been respected.

Figure 4 illustrates the definition of access rights of the patient in the information center 3 dar.

The patient N may in a step S6 z. Through the Dataroom Access System 2 is a list of all of his currently available in the overall system retrieve standing data from the information center 3. Alternatively, he can too just retrieve a list of specific data. Processed in a step S7 the information center will submit this request and send the requested one List to the Dataroom Access System 2. The patient N can now access rights at the data indicated by the list. Does he have z. B. a list of all his x-ray images requested, he can define that the doctor B and / or any other doctor or group of doctors on the x-ray image produced by the doctor A on day X with identification NXAX can access. Such access rights may be limited in time or unlimited. The access right may also be in advance for others in the future available data. Has the patient N defines all desired access rights, so he can in one step S8 via the Dataroom Access System 2 an update of the access rights effect in the Inforamationscenter 3. The information center 3 stores in a step S9 the changes and sends an acknowledgment back to the Dataroom Access System 2.

These access rights can alternatively be assigned at the time, to which new data is stored in a data room access system 1, 2 become. A patient or other rights holder in one Dataroom access system 1, 2 stored data may have access rights of Any data space access system 1. 2 assigned. Conceivable it would be z. B. that such Datraum access systems 1, 2 next to her Location in medical practices or hospitals also in pharmacies or that a practice network can also be accessed via the Internet can, making any Internet-enabled computer a data-room access system or at least could become an access system which does not provide storage space. The owner of the rights in a data room access system 1, 2 stored data, here so the Patient, is the only person due to his authorization and identification the access rights are displayed by the information center 3 and / or which you can modify in the information center 3.

Figure 5 shows the necessary for a successful access to certain data Procedure.

After the definition of access rights to the recorded on day X by the doctor A. X-ray picture of the patient N with the identification NXAX for the doctor B by the patient N starts the doctor B in a step S10 a new request to the information center, all references to the X-ray images of patient N indicate. In a step S 11 represents the Information Center is a list of all references currently in all Dataroom access systems existing X-ray images of the patient N together, checks the access permissions regarding the requesting physician B and selects only the X-ray images that access the doctor B. is allowed to add the associated references to the Dataroom Access System 2 from which the doctor B sends the request to the information center has executed. In this case, z. For example, just identify NXAX's on day X by the doctor A created X-ray image of the patient N together with the storage location / address, here the data space access system 1 with the identifier DRZS1, transmitted to the data space access system 2, which the doctor B displays this information. The doctor B can therefore only the references see data to which the patient N grants access to the physician B. Has. The references can z. B. the type of data, here X-ray image, the date of the examination, here the day X, the examining doctor, Here is the doctor A, the location of the data, here the data room access system 1 with the identifier DRZS1, or even more data included. In At a step S 12, the doctor B selects the X-ray image with the identification NXAX, whereupon the data space access system 2 requests the physician B via the X-ray image with the identification NXAX to the Dataroom access system with the ID DRZS1, here the Dataroom access system 1 sends. In a step S13, the data room access system 1 then sends a request to the information center 3 to confirm that the Doctor B the access rights to the X-ray with the identification NXAX has. The information center 3 responds in a step S 14 with a Confirmation, whereupon the Dataroom Access System 1 in one step S 15 the data of the X-ray image with the identification NXAX to the Dataroom access system 2 transmits. This represents the received data the radiograph in acceptable form and / or leaves the doctor B the data store for further processing, such storage not in the secure memory of the Dataroom Access System 2, but must be done on another storage medium, otherwise the data would be multiple times in the system.

Has an authorized person the received data once for the further Of course, processing stored, so it can always be stored on these Access data. However, access via the practice network is only possible as long as possible, as it is the holder of the rights to this data on the definition the access rights allowed.

Since, therefore, according to the method of the invention, a storage of certain Data only with the consent of the owner of the rights to these Data is possible and retrieval of such data only with consent the owner of the rights to these data is possible, the personal rights z. B. a patient. The system works for everyone User completely transparent, with the individual user no knowledge about the security or transmission procedures must have. By the encryption of the sent data can be unauthorized persons not "listening in" and by defining certain access rights for certain data by the holder of the rights to them can not unauthorized access to the data.

When transferring the data, it is of particular advantage if the from Holder of the access rights specified purpose of the transmission of these Data in the original data context together with this data in Form of "electronic watermark" and additionally this data Visibly marked as a dedicated copy of the original data become.

The inventive method for secure access to data in one Of course, network can also be applied to other non-medical networks be applied, since here a system for controlling the distribution of individual Data is proposed. Another area of application is z. B. the distribution of personal data to their identification, thereby reducing the transfer this data z. Between different administrative authorities made more flexible without a centralized database of individual citizens can be. By the system according to the invention has only the affected Citizens themselves and solely the power over their individual data.

Claims (24)

1. A method for secured access to data in a network including an information centre (3) and a plurality of data area access systems (1,2) in which permission to store and define access rights of third parties to data at the information centre (3) are limited to the owner of rights to said data to be stored, wherein:

   the data area access system (1,2) are not accessible to the owner of the rights.

   the data are stored only once and remain at their storage place and may not centrally gathered.

   registering the presence of data of a certain type in each data area access system (1) at said information centre (3), should he wish, defining access rights of third parties to said data at said information centre (3);

   transmitting a list of the data present of a certain type, specifying the data area access system (1) storing said data, from said information centre (3) to a requesting data area access system (2) for which the access rights of said requesting data area access system (2) correspond to the access rights defined at said information centre (3) for said data, and after a request of a requesting data area access system (2) for data of a certain type; and then

   directly transmitting said data of said certain type by said data area access system (1) storing said data to said requesting data area access system (2) subject to said data area access system (1) storing said data having received a confirmation from said information centre (3).
2. A method as defined in Claim 1, wherein an authorisation of the storage of data and of the definition of the access rights of third parties to the data takes place by means of an identity check of the owner of the rights to the data.
3. A method as defined in Claim 1 or 2, wherein data to be stored are stored in said data area access system (1) with an electronic form which contains the type of the data.
4. A method as defined in one the Claims 1 to 3, wherein a data area access system (1) storing data responds to a request for certain data of a certain type by a requesting data area access system (2) by verifying the access rights through an inquiry to the information centre (3) as to whether the requesting data area access system (2) has access rights to the certain data of a certain type.
5. A method as defined in one the Claims 1 to 4, wherein a data area access system (2) receiving certain data of a certain type allows access to the received data only directly after a respective reception of said data.
6. A method as defined in one the Claims 1 to 5, wherein a data area access system (1) storing certain data of a certain type grants access to the certain data of a certain type only if a positive verification has taken place through an inquiry to the information centre (3) as to whether said data area access system (1) storing said certain data of a certain type can show access rights for said data of a certain type.
7. A method as defined in one the Claims 1 to 6, wherein the information centre (3) is notified by a data area access system (1) having new data about the presence of new data of a certain type, whereupon said information centre (3) sends a notifying confirmation to the data area access system (1).
8. A method as defined in one the Claims 1 to 7, wherein said data are identified on the basis of an identification which is allocated as a unique identification by said information centre (3) and is transmitted by said information centre (3) after registration of a new data to the data area access system (1) storing said data, in order for said system to append the respective identification to the respective data.
9. A method as defined in one the Claims 1 to 8, wherein after an inquiry for data of a certain type by a data area access system (2), said information centre (3) prepares a list of all the data present of this certain type before it verifies the access rights to the data of the certain type, in order to transmit the list of data present of this certain type, specifying the data area access system (1) respectively storing these data, to the requesting data area access system (2) for which the requesting data area access system (2) can show said access rights.
10. A method as defined in one the Claims 1 to 9, wherein when data access is desired by a data area access system (2) to data of a certain type, firstly a request for such data of the certain type is sent to the information centre (3).
11. A method as defined in one the Claims 1 to 10, wherein when data transmission is desired from a data area access system (1) storing data to a requesting data area access system (2), firstly a request for certain data of a certain type is sent by the latter system to the data area access system (1) storing these certain data of a certain type.
12. A method as defined in one the Claims 1 to 11, wherein the data in a data area access system (1) are stored in a secure memory, no direct access being possible to the data stored therein.
13. A method as defined in one the Claims 1 to 12, wherein the type of the data is determined by their content and/or the owner of the rights to the data.
14. A method as defined in one the Claims 1 to 13, wherein the access rights to stored data can be defined by the owner of the rights to the data at any point in time after their registration at the information centre (3) and, after that, can be changed again as desired by re-definition by the owner of the rights to the data.
15. A method as defined in one the Claims 1 to 14, wherein the access rights to stored data can be granted by the owner of the rights to the data when they are stored in a data area access system (1).
16. A method as defined in one the Claims 1 to 15, wherein communication between a data area access system (1,2) and the information centre (3) or another data area access system (1,2) takes place in encrypted form.
17. A method as defined in Claim 16, wherein the sender provides the information sent by him with a digital signature by means of a secret signature code, whereby the recipient can verify the sent information by means of an associated public signature code.
18. A method as defined in Claims 16 or 17, wherein the sender encodes all transmitted data by means of a public encryption code issued by the recipient, whereby only the recipient can decode the transmitted data by means of a secret encryption code.
19. A method as defined in one the Claims 16 to 18, wherein not only each data area access system (1,2) and the information centre (3) but also each participant has a secret signature code and a secret encryption code and a public signature code and a public encryption code.
20. A method as defined in Claim 19, wherein the secret signature codes and encryption codes and/or public signature codes and encryption codes of a participant are stored on a data carrier, such as a smart card.
21. A method as defined in one the Claims 1 to 20, wherein a participant accessing the network must authorise himself and his identity is verified by the information centre (3).
22. A method as defined in Claim 21, wherein the identity of a participant is stored on a data carrier such as a smart card.
23. A method as defined in one the Claims 1 to 22, wherein the permission for storing the data is given by the owner of the rights to the data at the latest when the data are registered at the information centre (3), said information centre (3) not allowing any subsequent data access to these data without correct authorisation.
24. A method as defined in at least one of the preceding Claims, wherein when the data are transmitted, the appropriation specified by the owner of the access rights for the transmission of these data in the original data context is transmitted together with these data in the form of an electronic watermark and these data are additionally marked visibly as an appropriated copy of the original data.

Images